Docs
Sign in
On this page

Cloudflare

Keep Cloudflare Workers secrets and Pages environment variables in sync with your StitchDB project, and add a Hyperdrive configuration for fast Postgres from Workers.

Link a Cloudflare Worker or Pages project and StitchDB writes the connection details into it. Workers get them as secrets, which apply at once without a redeploy. Pages projects get environment variables for Production and/or Preview, which apply to the next deployment. When you rotate the API keys, linked projects get the new keys straight away.

  1. Create an API token at dash.cloudflare.com/profile/api-tokens for the account, with Workers Scripts: Edit (for Workers), Cloudflare Pages: Edit (for Pages) and Hyperdrive: Edit (if you want Hyperdrive). Account Settings: Read lets the dashboard list your accounts.
  2. In your project, open Integrations › Cloudflare and choose Link a Worker or Pages project.
  3. Paste the token, choose Find projects, then pick the account and the Worker or Pages project. For Pages, also pick the framework and the environments.

The token is stored encrypted. Only project owners and administrators can link, change or disconnect.

#Variables

  • STITCHDB_URL and STITCHDB_ANON_KEY: API URL and anon key. Always.
  • <prefix>STITCHDB_URL and <prefix>STITCHDB_ANON_KEY: the same with a framework prefix (Pages only), so browser code built by Pages can read them: NEXT_PUBLIC_, VITE_, PUBLIC_, NUXT_PUBLIC_, EXPO_PUBLIC_, REACT_APP_, or none.
  • STITCHDB_SERVICE_ROLE_KEY: the service_role key (bypasses Row Level Security), if you turn it on.
  • DATABASE_URL and DIRECT_URL: Postgres through the pooler, transaction mode (6543) and session mode (5432), if you turn it on.

In Workers every value is a secret (env.STITCHDB_URL). In Pages, the keys and URLs that must stay private are saved as encrypted secrets and the rest as plain text.

src/index.js
import { createClient } from 'stitchdb-js'

export default {
  async fetch(request, env) {
    const stitchdb = createClient(env.STITCHDB_URL, env.STITCHDB_ANON_KEY)
    const { data } = await stitchdb.from('todos').select('*').limit(10)
    return Response.json(data)
  },
}

#Hyperdrive

Tick A Hyperdrive configuration and StitchDB creates one named stitchdb-<ref> that points at your database through the session pooler. Hyperdrive keeps connections warm close to your Worker, so a Postgres driver such as postgres or pg connects fast. The dashboard shows the configuration id; bind it in wrangler.toml:

wrangler.toml
[[hyperdrive]]
binding = "HYPERDRIVE"
id = "<id from Integrations › Cloudflare>"
src/index.js
import postgres from 'postgres'

export default {
  async fetch(request, env) {
    const sql = postgres(env.HYPERDRIVE.connectionString)
    const rows = await sql`select id, title from todos limit 10`
    return Response.json(rows)
  },
}

When the database password changes, StitchDB updates the configuration in place, so the id stays the same. Queries through Hyperdrive use the project's owner role, so Row Level Security does not apply: check access in your Worker.

#Disconnect

Disconnect stops the sync. Tick Also delete to remove the variables StitchDB wrote and its Hyperdrive configuration; variables you added yourself are never touched.

#API

The same with the Management API (projects:write):

Terminal
curl -X POST https://stitchdb.com/platform/v1/projects/<ref>/integrations/cloudflare \
  -H "Authorization: Bearer $STITCHDB_TOKEN" -H "Content-Type: application/json" \
  -d '{ "token": "<cloudflare token>", "account_id": "<account id>", "kind": "worker", "name": "api-worker",
        "service_key": false, "database_url": false, "hyperdrive": true }'

kind is worker or pages; for Pages also send targets (production, preview) and prefix. POST …/cloudflare/browse lists what a token can reach, GET lists links, PATCH …/cloudflare/<id> changes one, POST …/cloudflare/<id>/sync writes again, DELETE …/cloudflare/<id>?remove_variables=true disconnects.

Was this helpful?